Readiness assessment

Concept

Processing

Processing is almost anything you do with personal data, from collecting and storing it to using, sharing or deleting it, where the operation is wholly or partly automated.

Defined inSection 2(x)
CategoryCore Concepts
Applies toAny operation performed on personal data

What the Act says

DPDP Act 2023, Section 2(x)

"processing" in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction.

In plain language

The definition is deliberately broad. Collection, storage, use, sharing and even erasure all count. If you touch digital personal data, you are almost certainly processing it.

Because the scope is wide, the trigger for obligations is low: as soon as you process personal data for a purpose, you need a lawful basis and take on the duties that follow.

Example

Storing customer emails, sending a newsletter, and later deleting an account are three separate acts of processing.

Related terms

Related sections of the Act

Related Rules

Frequently asked questions

Does storing data count as processing?

Yes. Storage is expressly listed, so simply holding personal data is processing.

Does deleting data count?

Yes. Erasure and destruction are named in the definition.

Continue learning